一般的登入認證系統, 需要輸入帳號和正確的密碼, 才會被認定為合法使用者允許登
入, 但, 網路上面存在一些監聽程式, 能夠在傳輸資料的時候竊取到使用者的帳號密
碼。因此, 只有帳號密碼是不安全的, 我們需要多一層防護來確保安全性。
在本論文中, 我們比較了三種方法分析其用於敲鍵認證上之優勢和不足之處。第一個
作法是透過將二十筆學習資料排序, 訂立出三種範圍給予適當權重, 而判斷測試資料
落於那個區域給予其權重, 最後這些加權過後的特徵值如果大於某個門檻則予以接受,
反之則拒絕。
而第二種作法跟第三種作法本質上是相似的, 都是將資料粗分。用粗分的二十筆學習
資料與粗分的測試資料作相似度比對。精神在於一個人的打字速度可能會經過練習而
變快或者是疏於接觸而變慢, 但鍵盤的相對位置及手指的長度大小還有個人不同的斷
句習慣, 會形成個人的打字節奏。
本實驗參與者共有22人, 實驗方式為合法使用者自行選擇一組自己最熟悉之帳號與密
碼, 並建立其打字模型, 入侵者隨機式選擇攻擊之對象。

In login systems, a user is asked to enter his correct account and password
in order to be allowed to enter to the system. The safety of systems is at the
risk of leaking out the information, hence, the single mechanism of identity
verification has not filled the bill at present. We study the personal typing
behavior to get one’s own specific features.
In our thesis , we compare three methods and anlysis the advantages and
shortcomings of those three. First one is to sort the twenty study data, and
distribute the weights into the proper region. If the total weights is less than
the threshold then this test data will be accepted, otherwise, it will be rejected.
The second and third method are similar. Both of them are trying to rescale
the data. The spirit of them is that the typing rate of a person will be faster
when they type frequently and will be sloer when they are out of practice.
However the relative positions of those keys, the lengths of ons’s fingers, and
the time that people making pauses in reading unpunctuated are unique.
Those factors can be one’s typing rhythm.
There are twenty two individuals involved in this experiment. Each one
choose his own proficient account and password to type and set up his typing
model. The imposters are randomly choose legal user to imitate.

1 緒論 1
1.1 研究背景. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 研究動機. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 背景. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3.1 相關研究. . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3.2 Commercial products . . . . . . . . . . . . . . . . . . . 7
1.4 論文架構. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2 敲鍵認證系統介紹 9
2.1 認證系統. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2 敲鍵認證系統. . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3 特徵值的選取. . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4 效能評估方法. . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.5 學習資料筆數選取. . . . . . . . . . . . . . . . . . . . . . . . . . 14
3 作法一: Ranking Method 16
3.1 敘述統計. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1.1 極端值. . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1.2 偏態與峰態. . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2 演算法精神. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.2.1 四分位數(Quartile) . . . . . . . . . . . . . . . . . . . . 18
3.2.2 為什麼使用四分位數而不使用平均值與標準差. . . . . . . . 18
3.3 學習資料的採樣. . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.4 認證方式. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.5 實驗結果描述. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.5.1 合法使用者登入之實驗結果. . . . . . . . . . . . . . . . . 19
3.5.2 非法入侵者登入之實驗結果. . . . . . . . . . . . . . . . . 21
4 作法二: Rhythm Method 22
4.1 背景. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.1.1 摩斯密碼. . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.1.2 人類的短期記憶. . . . . . . . . . . . . . . . . . . . . . . 22
4.2 演算法精神. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.3 演算法主體. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.3.1 Tempo 函式. . . . . . . . . . . . . . . . . . . . . . . . 24
4.3.2 Score 函式. . . . . . . . . . . . . . . . . . . . . . . . . 24
4.4 學習資料的採樣. . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.5 認證方式. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.6 實驗結果描述. . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.6.1 合法使用者登入之實驗結果. . . . . . . . . . . . . . . . . 26
4.6.2 非法入侵者登入之實驗結果. . . . . . . . . . . . . . . . . 26
5 作法三: Sorting Method 28
5.1 順序(等級) 尺度. . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.2 均勻量化與非均勻量化. . . . . . . . . . . . . . . . . . . . . . . 28
5.3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.3.1 打字樣本標記. . . . . . . . . . . . . . . . . . . . . . . . 29
5.3.2 學習資料處理. . . . . . . . . . . . . . . . . . . . . . . . 29
5.3.3 兩打字樣本之差距. . . . . . . . . . . . . . . . . . . . . . 31
5.3.4 認證方法. . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.4 學習資料的採樣. . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.5 實驗結果描述. . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.5.1 合法使用者登入之實驗結果. . . . . . . . . . . . . . . . . 32
5.5.2 非法入侵者登入之實驗結果. . . . . . . . . . . . . . . . . 33
6 實驗設計及結果 34
6.1 實驗設計. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6.1.1 The Volunteers . . . . . . . . . . . . . . . . . . . . . . 34
6.1.2 硬體配備. . . . . . . . . . . . . . . . . . . . . . . . . . 34
6.1.3 蒐集資料. . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.1.4 實驗設計. . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.2 三種方法實驗結果比較. . . . . . . . . . . . . . . . . . . . . . . 36
6.2.1 實驗結果. . . . . . . . . . . . . . . . . . . . . . . . . . 36
6.2.2 Method 1的資料觀察. . . . . . . . . . . . . . . . . . . 37
6.2.3 實作上的細節問題. . . . . . . . . . . . . . . . . . . . . . 37
6.2.4 Method 1與其他方法的比較. . . . . . . . . . . . . . . . 37
6.2.5 Method 2與其他方法的比較. . . . . . . . . . . . . . . . 38
6.2.6 相關係數觀察. . . . . . . . . . . . . . . . . . . . . . . . 39
7 結論 41
7.1 相關問題. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
參考文獻 43
附錄 46
A 本論文測試人員資料 46
B 其它統計資料 48
viii

[1] 辛宗秦. Design and implementation of user authentication
based on keystroke dynamic. Master’s thesis, National Sun
Yat-sen University, 2008.
[2] 童惠玲李德治. 應用統計學. 博碩文化, 2008.
[3] Shivani Hashia A, Chris Pollett B, and Mark Stamp C. On
using mouse movements as a biometric.
[4] L. C. F. Araujo, L. H. R. Sucupira Jr., M. G. Lizarraga, L. L.
Ling, and J. B. T. Uabu-Tti. User authentication through typing
biometrics features. IEEE Transactions on Signal Processing,
53(2):851–855, Feb 2005.
[5] S. Bleha, C. Slivinsky, and B. Hussien. Computer-access security
systems using keystroke dynamics. IEEE Transactions
on Pattern Analysis and Machine Intelligence, 12(12), Dec
1990.
[6] Chiara Braghin. Biometric authentication. Technical report,
2000.
[7] W. G. de Ru and J. H. P. Eloff. Enhanced password authentication
through fuzzy logic. IEEE Expert, 17(6):38–45, Nov
1997.
[8] Sungzoon Cho Enzhe Yu. Keystroke dynamics identity
verification-its problems and practical solutions. Computer
and Security, 23(5):428–440, 2004.
[9] Aviel Rubin Fabian Monrose. Authentication via keystroke
dynamics. 1997.
[10] Wong F. W. M. H., Supian A. S. M., and Ismail A. F. Enhanced
user authentication through typing biometrics with artificial
neural networks and k-nearest neighbor algorithm. In
Conference Record of the Thirty-Fifth Asilomar Conference
on Signals, Systems and Computers, volume 2, pages 911–
915, 2001.
[11] S. Hocquet, J. Ramel, and H. Cardot. Fusion of methods for
keystroke dynamic authentication. Fourth IEEE Workshop on
Automatic Identification Advanced Technologies, pages 224–
229, Oct 2005.
[12] D. Hosseinzadeh, S. Krishnan, and A. Khademi. Keystroke
identification based on gaussian mixture models. IEEE International
Conference on Acoustics, Speech and Signal Processing
(ICASSP), May 2006.
[13] Marina Gorunescu Kenneth Revett, Florin Gorunescu and
Marius Ene. A machine learning approach to keystroke dynamic
based user authentication. Electronic Security and Digital
Forensics, 1(1):55–69, 2007.
[14] Qiming Li, Yagiz Sutcu, and Nasir Memon. Secure sketch for
biometric templates. In In Asiacrypt, pages 99–113. Springer-
Verlag, 2006.
[15] G Miller. Plus or minus two. Psychological Review, 63(2):81–
97, 1956.
[16] M. Obaidat and S. Sadoun. Verification of computer users
using keystroke dynamics. IEEE Transactions on Systems,
Man and Cybernetics, part B: Cybernetics, 27(2):261–269,
1997.
[17] J. A. Robinson, V. W. Liang, J. A. M. Chambers, and Christine
L. MacKenzie. Computer user verification using login
string keystroke dynamics. IEEE Transactions on Systems,
Man, and Cybernetics, 28(2):236–241, 1998.
[18] S. James Press Norman Shapiro R.Stockton Gaines,
William Lisowski. Authentication by keystroke timing: some
prelimary results. Tech. rep. Rand Corporation, (R-2526-
NSF):48, 1980.
[19] Ki seok Sung and Sungzoon Cho. Ga svm wrapper ensemble
for keystroke dynamics authentication. In IAPR International
Conference on Biometrics, pages 5–7, 2006.
[20] Yong Sheng, V. V. Phoha, and S. M. Rovnyak. A parallel
decision tree-based method for user authentication based on
keystroke patterns. IEEE Transactions on Systems, Man,
and Cybernetics, Part B, 35(4):826–833, 2005.
[21] Dae Hee Han Hyung-Il Kim Sungzoon Cho a, Chigeun Han.
Web-based keystroke dynamics identity verification using neural
network. Journal of Organizational Computing and Electronic
Commerce, 10:295–307, 2000.
[22] Marino Tapiador, Juan A. Sigenza, Grupo De Neurocomputacin
Biolgica, Escuela Tcnica, and Superior Informtica.
Fuzzy keystroke biometrics on web security.
[23] Michiel Van Der Veen, Tom Kevenaar, Geert jan Schrijen,
Ton H. Akkermans, Fei Zuo, and Prof Holstlaan. Face biometrics
with renewable templates. In Proceedings of SPIE,
Volume 6072: Security, Steganography, and Watermarking
of Multimedia Contents VIII, Edward J. Delp III, Ping Wah
Wong, Editors, 60720J, page 2006, 2006.
[24] Chen W. and Chang W. Applying hidden markov models
to keystroke pattern analysis for password verification. Proceedings
of IEEE International Conference on Information
Reuse and Integration, pages 467–474, 2004.